Re: [Qemu-devel] [Qemu-trivial] [PATCH] vt82c686: avoid out-of-bounds read

2015-01-12 Thread Michael Tokarev
10.12.2014 12:17, Paolo Bonzini wrote: > superio_ioport_readb can read the 256th element of the array. > Coverity reports an out-of-bounds write in superio_ioport_writeb, > but it does not show the corresponding out-of-bounds read > because it cannot prove that it can happen. Fix the root > cause

Re: [Qemu-devel] [Qemu-trivial] [PATCH] vt82c686: avoid out-of-bounds read

2014-12-11 Thread Paolo Bonzini
On 11/12/2014 18:55, Michael Tokarev wrote: >> > superio_ioport_readb can read the 256th element of the array. > Is there a legitimate reason for it to access byte index 256? The 256th element is byte index 255. :) > What is the actual size of superio config memory, 256 or 257? It's 256 and th

Re: [Qemu-devel] [Qemu-trivial] [PATCH] vt82c686: avoid out-of-bounds read

2014-12-11 Thread Michael Tokarev
10.12.2014 12:17, Paolo Bonzini wrote: > superio_ioport_readb can read the 256th element of the array. Is there a legitimate reason for it to access byte index 256? What is the actual size of superio config memory, 256 or 257? I don't know, but somehow it looks like it should be 256. If that's the